It is still not entirely clear where the photos come from, aside from those taken during criminal processing, but there are clues.

Roughly half of the states are already participating with the feds' project or have expressed interest in participating, according to the documents obtained.

"If you apply for any type of job that requires fingerprinting or a background check, your prints are sent to and stored by the FBI in its civil print database," the EFF reported. "However, the FBI has never before collected a photograph along with those prints. This is changing with NGI. Now an employer could require you to provide a 'mug shot' photo along with your fingerprints. If that’s the case, then the FBI will store both your face print and your fingerprints along with your biographic data."

According to The Huffington Post, Jennifer Lynch, an EFF staff attorney, said the FBI could not only link the NGI database to publically available photos on places like Facebook and other social media websites, but it could also source photos from state drivers' license databases, effectively pulling the vast majority of the population into the system.

Of particular concern to privacy advocates and the EFF is the mixing of criminal and non-criminal photos, the problem of false positives in the identification algorithms, and third-party oversight of the project.

The documents obtained, which include redactions and omissions, don't make clear why the mixing is taking place or how the bureau intends to protect against false identifications.

Concerning oversight, Lynch said, "There should be congressional oversight of this, and there should be rules."

In 2012, the database had photos of approximately 13 million photos, and grew to 16 million by 2013.